What should organisations do when AI usage is already widespread across the workforce?

What organisations need to change once AI use is already happening everywhere

When AI is already embedded in day-to-day work, the right response is to regain visibility and control without forcing people into covert workarounds. The practical shift is from prohibition to governance: identify where AI is being used, what data is entering it, which workflows are at risk, and where narrow restrictions or stronger monitoring are justified.

The first priority is discovery. You need to know which tools, browser extensions, copilots, plug-ins and embedded features are being used, because a policy that only covers approved enterprise tools will miss the bulk of real-world activity. Treat this as a control problem, not a communications problem: inventory usage, classify the data being shared, and separate low-risk experimentation from sensitive operational use.

That is where a careful policy structure matters. An AI Acceptable Use Policy Template is useful when the goal is to set clear rules on approved tools, prohibited uses, human review and employee acknowledgement without pretending that usage can simply be eliminated. The policy should describe what is allowed, what is restricted, and what requires escalation, so employees do not have to guess.

How to reduce exposure without driving AI deeper underground

Once usage is visible, the next step is to classify the risk of the content and the workflow, then apply controls proportionately. Not every prompt needs the same treatment. A draft email, a marketing brainstorm and a customer record are not equivalent. Organisations get better results when they focus restrictions on the highest-risk data, the most sensitive business processes and the most likely leak paths, rather than imposing a single global rule on all AI use.

Data handling controls are often the deciding factor. The key question is whether the content being pasted, summarised or generated includes secrets, regulated data, customer information or other material that should not leave the boundary. Generative AI Data Loss Prevention Guide is relevant here because it focuses on practical guardrails such as prompt redaction, browser controls, copilot labels, RAG oversharing and prompt logging. Those controls matter when the problem is not AI itself, but uncontrolled data movement through AI interfaces.

Targeted restrictions work best when they are specific enough to be obeyed. For example, you may allow general-purpose writing assistance while blocking uploads from designated sensitive repositories, or require human review before AI-generated content reaches customers, code repositories or regulated records. The goal is not to stop all use, but to make the riskiest uses harder, more visible and more accountable.

What behavioural monitoring should prove before stronger controls are added

Monitoring should answer one simple question: is AI use creating a measurable exposure that policy alone is not reducing? Useful signals include repeated use of unapproved tools, sharing of sensitive classifications, evidence of prompt copying from confidential systems, or patterns showing that staff are bypassing approved channels because they are too restrictive or too slow. If you cannot observe the behaviour, you cannot govern it effectively.

Monitoring also helps separate education problems from control gaps. Some teams need clearer examples of what should never be entered into an AI system. Others need browser-level blocking, data redaction, or tighter access rules around source systems. The point is to use evidence to decide whether the next step is guidance, technical restriction, or both.

A broader policy architecture helps keep that response coherent. Security Policy Framework Guide is a good fit for organisations that need to align the AI policy with the wider policy hierarchy, owners, review cycle and exception handling. That matters because ad hoc AI rules tend to fragment quickly unless they sit inside a durable governance structure.

Practitioner Guidance

What to prioritise: Start with discovery and classification before you reach for bans. If you do not know where AI is already used, restrictions will be patchy and employees will move to shadow channels that are harder to see and govern.

Decision rule: If the workflow touches sensitive data, regulated content or high-impact business decisions, apply targeted controls first, then monitor whether usage shifts to safer channels. If the use is low risk and productivity-positive, allow it with clear rules rather than forcing it underground.

What to verify: Check that employees can distinguish approved tools from unapproved ones, that restricted data categories are explicit, and that exceptions have an owner and a review path. A policy is only credible when people know what changes in practice.

What practitioners underestimate: Overly broad bans often create the very exposure they are meant to prevent. The better measure of success is not zero AI use, but visible, bounded and governable use.

Practitioner takeaway: The strongest control posture is usually selective restriction, not blanket prohibition, because visibility and bounded use are what let organisations reduce exposure without losing oversight.

Related resources from NHI Mgmt Group

• What breaks when organisations do not have visibility into AI app usage across the workforce?
• How should organisations attribute AI spend when usage is spread across tools and agents?
• Why do organisations need AI usage governance even if they already have model governance?
• Why do MCP registries matter when organisations scale AI tool usage across teams?